From a general glimpse of it, it seems that source code for Meteor app is open to the clients due to \'Write one Javascript file, run it on client and server at once\' theme.
The best way to secure a client-server app is by writing explicit security checks on the server, rather than hiding the database update logic from the client.
For a longer explanation of the security model, see https://stackoverflow.com/a/13334986/791538.